Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198

Key facts for Talos IR trends Q3 2026

Detection coverage for Talos IR trends Q3 2026

As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4980 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Cisco IOS XE CVE-2023-20198 Exploitation - Rogue Accounts, Web UI Install Operations and Talos IOC Sources

Detects exploitation of CVE-2023-20198 (Cisco IOS XE web UI, Salt Typhoon / BadCandy) in IOS XE syslog: creation or use of the rogue local accounts cisco_tac_admin, cisco_support and cisco_sys_manager, any reference to the Talos 2023 suspicious IPs 5.149.249.74 and 154.53.56.231, or a web UI login followed by a %WEBUI-6-INSTALL_OPERATION_INFO event on the same device. Unauthenticated privilege-15 access on an internet-exposed management plane is the entry point for the BadCandy Lua implant (TL-2026-4980).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1136.001, T1078
• Data sources: cisco_ios_xe_syslog, index=network sourcetype=cisco:ios, Syslog table (Microsoft Sentinel)
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype="cisco:ios" earliest=-24h ("%WEBUI-6-INSTALL_OPERATION_INFO" OR "%SEC_LOGIN-5-WEBLOGIN_SUCCESS" OR "%SYS-5-CONFIG_P" OR "cisco_tac_admin" OR "cisco_support" OR "cisco_sys_manager" OR "5.149.249.74" OR "154.53.56.231")
| eval indicator=case(match(_raw,"cisco_tac_admin|cisco_support|cisco_sys_manager"),"rogue_account_CVE-2023-20198", match(_raw,"5[.]149[.]249[.]74|154[.]53[.]56[.]231"),"talos_ioc_ip", match(_raw,"WEBUI-6-INSTALL_OPERATION_INFO"),"webui_install_operation", match(_raw,"SEC_LOGIN-5-WEBLOGIN_SUCCESS"),"webui_login", true(),"config_change")
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators by host
| where isnotnull(mvfind(indicators,"rogue_account_CVE-2023-20198")) OR isnotnull(mvfind(indicators,"talos_ioc_ip")) OR (isnotnull(mvfind(indicators,"webui_install_operation")) AND isnotnull(mvfind(indicators,"webui_login")))
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("%WEBUI-6-INSTALL_OPERATION_INFO", "%SEC_LOGIN-5-WEBLOGIN_SUCCESS", "%SYS-5-CONFIG_P", "cisco_tac_admin", "cisco_support", "cisco_sys_manager", "5.149.249.74", "154.53.56.231")
| extend Indicator = case(
    SyslogMessage has_any ("cisco_tac_admin", "cisco_support", "cisco_sys_manager"), "rogue_account_CVE-2023-20198",
    SyslogMessage has_any ("5.149.249.74", "154.53.56.231"), "talos_ioc_ip",
    SyslogMessage has "WEBUI-6-INSTALL_OPERATION_INFO", "webui_install_operation",
    SyslogMessage has "SEC_LOGIN-5-WEBLOGIN_SUCCESS", "webui_login",
    "config_change")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Indicators = make_set(Indicator) by Computer, HostIP
| where set_has_element(Indicators, "rogue_account_CVE-2023-20198") or set_has_element(Indicators, "talos_ioc_ip") or (set_has_element(Indicators, "webui_install_operation") and set_has_element(Indicators, "webui_login"))
| project FirstSeen, LastSeen, Computer, HostIP, EventCount, Indicators

Sigma

title: Cisco IOS XE CVE-2023-20198 Rogue Account or Web UI Install Activity
id: 3f7a1c52-8d4e-4b6a-9c21-5e0b7d4a1f01
status: experimental
description: Detects Cisco IOS XE logs referencing the rogue local accounts created via CVE-2023-20198 (cisco_tac_admin, cisco_support, cisco_sys_manager), the web UI install operation log event, or the Talos-reported suspicious source IPs. Associated with Salt Typhoon deployment of the BadCandy implant.
references:
  - https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
  - https://blog.talosintelligence.com/ir-trends-q3-2026/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/01
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
  - attack.persistence
  - attack.t1136.001
  - cve.2023.20198
logsource:
  product: cisco
  service: aaa
detection:
  keywords_rogue_account:
    - 'cisco_tac_admin'
    - 'cisco_support'
    - 'cisco_sys_manager'
  keywords_webui_install:
    - '%WEBUI-6-INSTALL_OPERATION_INFO'
  keywords_ioc_ip:
    - '5.149.249.74'
    - '154.53.56.231'
  condition: 1 of keywords_*
falsepositives:
  - Authorized administrators installing software packages through the IOS XE web UI
  - Legitimately named Cisco TAC support accounts provisioned by your organisation
level: high

Known false positives:

• Authorized administrators installing packages via the IOS XE web UI and then logging in the same day
• A legitimately provisioned account that happens to share a rogue account name such as cisco_support

Tuning notes: Restrict to IOS XE hosts via a lookup of management-plane devices, add change-window suppression for the webui_install_operation + webui_login pairing, and allowlist any sanctioned account that reuses a listed name. Talos IPs are historical (2023); treat matches as leads, not proof. Ensure logging buffered/host syslog forwarding is enabled so %WEBUI and %PARSER events reach the SIEM.

• 🔒 Help Desk Vishing - Quick Assist Session Followed by MeshAgent RMM Deployment · unlock with TL Creds
• 🔒 EDR Disablement - Security Process Termination, Defender Tampering, Kernel Driver Services and WDAC Policy Drops · unlock with TL Creds
• 🔒 Rclone Multi-Day Exfiltration to Cloud Storage · unlock with TL Creds
• 🔒 BadCandy Implant Probe - [indicator] and logoutconfirm logon_hash Requests to IOS XE Web UI · unlock with TL Creds
• 🔒 Windows Event Log Clearing and Suspicious Scheduled Task Persistence · unlock with TL Creds
• 🔒 PowerShell MSI Download and Install, Remote msiexec and Rundll32 Proxy Execution from User-Writable Paths · unlock with TL Creds
• 🔒 Cisco IOS XE Post-Exploitation - Privilege-15 Account Creation, GRE Tunnel and Logging Disablement · unlock with TL Creds
• 🔒 Lateral Movement - PsExec, Impacket SMBexec Services and Non-Interactive MSTSC Launches · unlock with TL Creds

Indicators of compromise for Talos IR trends Q3 2026

As of 2026-11-01, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-4980.

Sample indicators (2 of 22)

• IP address: 5.149.249[.]74
• IP address: 154.53.56[.]231

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

How Talos IR trends Q3 2026 works

Salt Typhoon was observed exploiting CVE-2023-20198 and deploying the BadCandy web shell against the telecommunications sector.

Cisco Talos Incident Response's Q3 2026 trends report (published 2026-10-29) summarizes engagement data. Ransomware and pre-ransomware activity accounted for 27% of engagements, up from a maximum of 20% over the previous four quarters. Phishing was the initial access vector in 37% of engagements (down from over 50% the prior quarter) and exploitation of public-facing applications accounted for 33%. Financial and public administration each made up 18% of targeted sectors; healthcare fell to third after leading the previous two quarters. Recurring weaknesses were insufficient logging (over 40% of engagements), improper credential/secret management (33%) and missing or insufficient MFA (33%).

A prominent technique was vishing in which actors impersonate the IT help desk and coach victims into granting remote access, using Microsoft Quick Assist and other legitimate RMM tooling. In the VYPR ransomware intrusion, the chain was vishing, a Quick Assist session, RMM software, a PowerShell-executed MSI download and install, EDR disablement through vulnerable drivers (BYOVD), and tools including MeshAgent, Rclone, PsExec, an IP scanner and MSTSC. VYPR is described as new and operationally immature: it had no data leak site at the time of the engagement, reused older leaked Conti-derived source code with minimal changes, and ran an extended exfiltration phase while the operators experimented. Other ransomware families named in the report are The Gentlemen, Qilin, Rhysida and Interlock (closed group model). Defense evasion in these engagements included malicious WDAC policies used to stop EDR, BYOVD, PsExec/taskkill termination of security processes, attempts to uninstall Cisco Secure Endpoint, disabling Windows Defender real-time protection, event log clearing, and scheduled tasks for persistence. Multi-day exfiltration to cloud storage was observed, which is atypical for ransomware.

Talos attributes with high confidence a telecommunications-sector espionage campaign to the China-affiliated Salt Typhoon. The actor exploited CVE-2023-20198 in the Cisco IOS XE web UI on public-facing management interfaces, combined with valid credentials, and deployed the BadCandy web shell for persistent access. Post-compromise activity included creating privileged accounts, disabling logging, altering configurations and blending with normal administrative operations. Legacy management protocols (plaintext SNMP, outdated VPN encryption), password-only authentication and weak credential management enabled the activity. Per Talos's 2023 advisory, CVE-2023-20198 gives unauthenticated attackers privilege-15 access and local account creation, and CVE-2023-20273 was chained for root command injection; BadCandy is a non-persistent 29-line Lua implant at /usr/binos/conf/nginx-conf/cisco_service.conf. The Australian Signals Directorate reported BADCANDY activity on Australian devices since July 2025. Public reporting additionally describes Salt Typhoon using GRE tunnels on compromised Cisco devices to collect traffic.

The report also notes emerging targeting of AI platform credentials: a trojanized macOS application scraped Anthropic Claude Code credentials from the macOS keychain, and an insider with false credentials used privileged access to install GitHub Copilot CLI and Claude Code. The report's MITRE appendix lists GoGRPC RAT (fly.exe), Node RAT, BadCandy, Overlord RAT, SideSlipRAT, Impacket SMBexec, MeshAgent, Rclone, PsExec, MSTSC and Rundll32. The article provides no IP, hash or domain IOCs of its own; network and host indicators below come from Talos's 2023 IOS XE advisory and are historical.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1569.002 System Services: Service Execution

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566.004 Phishing: Spearphishing Voice

Defense Evasion

T1218.011 System Binary Proxy Execution: Rundll32

Command and Control

T1219 Remote Access Tools; T1572 Protocol Tunneling

Credential Access

T1555.001 Credentials from Password Stores: Keychain

Exfiltration

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Remediation for Talos IR trends Q3 2026

Patches

• Apply Cisco fixes for CVE-2023-20198 and CVE-2023-20273 per Cisco advisory cisco-sa-iosxe-webui-privesc-j22SaA4z
• Update Rockwell Automation Stratix 5200/5800 firmware to 17.12.02 or later

Immediate actions

• Remove IOS XE web UI (HTTP/HTTPS server) exposure to the internet and untrusted networks
• Audit Cisco IOS XE devices for unknown local users (e.g. cisco_tac_admin, cisco_support, cisco_sys_manager) and unexpected %SYS-5-CONFIG_P, %SEC_LOGIN-5-WEBLOGIN_SUCCESS and %WEBUI-6-INSTALL_OPERATION_INFO log events
• Check for BadCandy with a request to https://DEVICEIP/%25 and review /usr/binos/conf/nginx-conf/cisco_service.conf
• Hunt for unsanctioned RMM tools (Quick Assist, MeshAgent), Rclone and PsExec on endpoints
• Alert on vulnerable driver loads and WDAC policy changes that precede EDR termination

Workarounds

• Disable the HTTP server feature with 'no ip http server' and 'no ip http secure-server' where the web UI is not required
• Reboot-based removal of BadCandy is not sufficient because created accounts persist; remove rogue accounts and patch

Longer-term hardening

• Centralize logging in a SIEM with at least 90 days of retention and forward logs off-device
• Move to phishing-resistant MFA (FIDO2/WebAuthn), restrict self-service MFA enrollment and require help desk identity verification
• Block legacy authentication via Conditional Access and condition access on device compliance
• Adopt formal credential and secret management including for AI platform tokens and API keys
• Replace plaintext SNMP and outdated VPN encryption on network management planes

Affected and fixed versions

• Cisco — IOS XE Software (web UI)
  Vulnerable versions: 16.1.1 through 17.12.1a with web UI enabled
  Fixed in: Cisco fixed releases per advisory cisco-sa-iosxe-webui-privesc-j22SaA4z
• Rockwell Automation — Allen-Bradley Stratix 5200 and 5800
  Vulnerable versions: firmware before 17.12.02
  Fixed in: 17.12.02

Timeline of Talos IR trends Q3 2026

• 2023-10-16 Cisco discloses CVE-2023-20198 as an exploited zero-day in IOS XE web UI; CISA adds it to the KEV catalog (action due 2023-10-20).
• 2023-10-20 locked-ioc-13 implant version 2 observed, adding an HTTP Authorization header check.
• 2023-11-02 locked-ioc-13 implant version 3 observed, checking Authorization or X-Csrf-Token headers and returning a login page for '%' in the URI.
• 2024-12-01 Public reporting states Salt Typhoon has exploited Cisco IOS XE flaws since at least December 2024, including a Canadian telecommunications provider, using GRE tunnels for traffic collection.
• 2025-07-01 ASD assesses over 400 Australian devices potentially compromised with locked-ioc-13 since July 2025.
• 2025-10-31 ASD ACSC publishes its locked-ioc-13 advisory; over 150 Australian devices remained compromised.
• 2026-10-29 Cisco Talos publishes IR Trends Q3 2026: ransomware at 27% of engagements, vishing impersonating IT help desks, Salt Typhoon exploiting CVE-2023-20198 with locked-ioc-13 against telecommunications.
• 2026-11-12 Talos IR Q3 2026 trends webinar scheduled.

Sources cited for Talos IR trends Q3 2026

• NVD CVE-2023-20198 NVD (NIST) · Advisory · 2023-10-16
• CISA Known Exploited Vulnerabilities Catalog entry for CVE-2023-20198 CISA · Government advisory · 2023-10-16
• ASD ACSC: BADCANDY implant on Cisco IOS XE devices cyber.gov.au · Advisory · 2025-10-31
• Cisco Security Advisory cisco-sa-iosxe-webui-privesc-j22SaA4z Cisco · Vendor report · 2023-10-16
• IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases Cisco Talos · Blog · 2026-10-29
• Active exploitation of Cisco IOS XE Software Web Management User Interface vulnerability (Talos) Cisco Talos · Blog · 2023-10-16
• Talos IR Trends Q2 2026 Cisco Talos · Blog · 2026-07-01
• Cybersecurity Dive: Hackers implant BADCANDY on Cisco IOS XE devices cybersecuritydive.com · News · 2025-10-31
• Vulert: China-linked Salt Typhoon exploits Cisco CVE-2023-20198 to breach Canadian telecom vulert.com · News · 2025-02-13

More in threat intel

• Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys
• OWASP Warns AI Agents Are Lowering the Skill Barrier for Cyberattacks (LLM Exploit Generation Guide 2.0)
• Hunting Malware C2 Infrastructure with FOFA Queries (AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic, Supershell)
• Kaspersky ICS CERT: Threat Landscape for Industrial Automation Systems, Q1 2026
• AI-Enabled Cyberattack Campaigns Against Japan: Three Cases Beyond ARTEX (CyberStrikeAI, LLM-Assisted Intrusions, AI-Written Tooling)

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors